Launchpad hook on HyperEVM

Uniswap v4 Hook Contract 0xf201641ea2985f079791c6a28c0d3ebfdebdeaec on HyperEVM · Launchpad

Volume (24h)
$0
Value locked (TVL)
$66
All-time volume
$1.89K
Pools using this hook
9
Swaps (24h)
0 (0 traders)
Total swaps
10

What it does

This hook appears to run a launchpad-style vesting and reward system on a Uniswap v4 pool, tracking owed and vested balances and adjusting swap and liquidity flows.

How it works step by step

  • Tracks owed and vested token balances per address and per token in contract storage
  • Exposes withdrawOwed and releaseVested functions that transfer tokens to recipients
  • Maintains an approved-router allowlist via setRouter
  • Runs custom logic in beforeSwap and afterSwap and can adjust swap deltas
  • Calls the pool manager's unlock and take to move currency
  • Records price, quote and pool state values for tracked pools
Swap behaviour
beforeSwap and afterSwap run custom logic that updates storage, and return-delta permissions let the hook change the token amounts exchanged.
Liquidity behaviour
beforeAddLiquidity, afterAddLiquidity, beforeRemoveLiquidity and afterRemoveLiquidity are all enabled, and the hook tracks owed balances per address and per token, so it appears to manage liquidity or vesting positions beyond the standard pool logic.
Fee behaviour
Unable to determine from decoded bytecode; the hook takes return deltas on swaps and records owed amounts, which suggests a custom fee or revenue split, but exact fee values are not visible.
Owner & admin controls
A setRouter(address,bool) function (selector 0xc3c64674) writes an approved-router allowlist (storage slot 4), with no owner check visible in the decoded selector list; the caller restriction cannot be confirmed without source. A 'MaximumQuads' view and 'MAX_DEV' view suggest configurable parameters, and releaseVested and withdrawOwed are callable functions whose access control is not determinable from decoded bytecode.

Enabled Uniswap v4 callbacks

beforeInitialize, beforeAddLiquidity, beforeRemoveLiquidity, beforeSwap, afterSwap, beforeDonate, beforeSwapReturnDelta, afterSwapReturnDelta

beforeInitialize and afterInitialize initialize pool state; beforeAddLiquidity, afterAddLiquidity, beforeRemoveLiquidity and afterRemoveLiquidity gate or record liquidity changes; beforeSwap and afterSwap run custom swap logic and update storage; beforeDonate and afterDonate are enabled; beforeSwapReturnDelta and afterSwapReturnDelta let the hook alter the swap's token deltas, so it can take or give tokens.

Security & trust assessment

Risk level: medium, estimated (decoded bytecode, low confidence).

Who controls it: The setRouter function can change which routers are approved, and the hook's interaction with the pool manager (unlock, take, flush, settle-style calls) means a privileged key may influence which callers can route swaps. Exact owner privileges cannot be confirmed without source.

Risk to user funds: The hook holds owed and vested token balances per address and can transfer tokens through withdrawOwed and releaseVested, and its return-delta permissions let it alter swap amounts, so user funds depend on the correctness and access control of these functions.

Security findings

  • [medium] Swap return deltas enabled: Both return-delta permissions are enabled, so the hook can take or give tokens during swaps, altering amounts users receive.
  • [medium] Hook moves currency via pool manager: The hook calls the pool manager's unlock and take functions and tracks owed balances, meaning it moves currency on behalf of users and itself.
  • [medium] Router allowlist change without visible access control: setRouter (0xc3c64674) writes the approved router mapping, and an access check cannot be verified from decoded bytecode.
  • [medium] Token withdrawal functions with unverified access control: withdrawOwed and releaseVested can transfer tokens to recipients; the caller restriction cannot be confirmed from bytecode.
  • [info] Unverified source: Decoded bytecode and storage layout show a launchpad-style vesting and reward structure; no proxy or upgrade pattern was identified, but the source is unverified.

Contract details

Verified source
No
Bytecode size
24,532 bytes
Upgradeable proxy
No
Detected patterns
moves-currency, return-delta, self-unlock

Pools using Launchpad hook